a9ef92c6c4071a57f67d8eb542a3d135b13ef4f3734b2bbde5e1a689a56fa9c1

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 06:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a-kind-of-magic-guitar-pro.html
Size 728B
Sample260809-gx2rdaha98
SHA256 a9ef92c6c4071a57f67d8eb542a3d135b13ef4f3734b2bbde5e1a689a56fa9c1
MD5 1f82ee914b51bd2734268f87365b8ca9
SHA1 04d9248d75155e73cc129d32e14ef8db04aff21e
SHA512 c4345c6f06aeb0b850f424ecc543ccbab7de4da5274f360fc299d386fb0010ca6e3995d42768676b2aecb58b7655b23e46a89505ad40b41f88be2587c35d3ad3
TLSH
T1D001C0DFCC1892932521D518EEAE7F40B223019A8640D9C7C9150DACD7E4276E1DF9AB
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1808	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307295294936709"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{EB9962BC-40F7-4B94-A5F8-DDD1FB67BFED}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 5084	3424	msedge.exe	86
PID 3424 wrote to memory of 1808	3424	msedge.exe	88
PID 3424 wrote to memory of 3040	3424	msedge.exe	89
PID 3424 wrote to memory of 3040	3424	msedge.exe	89
PID 3424 wrote to memory of 3040	3424	msedge.exe	89
PID 3424 wrote to memory of 1192	3424	msedge.exe	90
PID 3424 wrote to memory of 1192	3424	msedge.exe	90
PID 3424 wrote to memory of 2664	3424	msedge.exe	91
PID 3424 wrote to memory of 2664	3424	msedge.exe	91
PID 3424 wrote to memory of 2080	3424	msedge.exe	92
PID 3424 wrote to memory of 2664	3424	msedge.exe	91
PID 3424 wrote to memory of 2080	3424	msedge.exe	92
PID 3424 wrote to memory of 2080	3424	msedge.exe	92
PID 3424 wrote to memory of 4016	3424	msedge.exe	93
PID 3424 wrote to memory of 868	3424	msedge.exe	94
PID 3424 wrote to memory of 4016	3424	msedge.exe	93
PID 3424 wrote to memory of 4016	3424	msedge.exe	93
PID 3424 wrote to memory of 868	3424	msedge.exe	94
PID 3424 wrote to memory of 868	3424	msedge.exe	94
PID 3424 wrote to memory of 3204	3424	msedge.exe	98
PID 3424 wrote to memory of 3996	3424	msedge.exe	99
PID 3424 wrote to memory of 3204	3424	msedge.exe	98
PID 3424 wrote to memory of 3996	3424	msedge.exe	99
PID 3424 wrote to memory of 5080	3424	msedge.exe	103
PID 3424 wrote to memory of 4664	3424	msedge.exe	110
PID 3424 wrote to memory of 1652	3424	msedge.exe	111
PID 3424 wrote to memory of 1496	3424	msedge.exe	112
PID 3424 wrote to memory of 4684	3424	msedge.exe	113
PID 3424 wrote to memory of 4684	3424	msedge.exe	113
PID 3424 wrote to memory of 1712	3424	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\a-kind-of-magic-guitar-pro.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff0f64c188,0x7fff0f64c194,0x7fff0f64c1a0
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,16579141170467199775,17494444444642681098,524288 --field-trial-handle=2084,i,12736288640331117602,10499490202572124347,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,4585638108815687691,6164232880368050353,262144 --field-trial-handle=2084,i,12736288640331117602,10499490202572124347,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1348,i,13327018432311458919,18291013055784287825,524288 --field-trial-handle=2084,i,12736288640331117602,10499490202572124347,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,3511923551662466421,8577482566350265151,2097152 --field-trial-handle=2084,i,12736288640331117602,10499490202572124347,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,11405327115715296083,4009266668854530590,2097152 --field-trial-handle=2084,i,12736288640331117602,10499490202572124347,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,18121030821534364194,18027420638525858373,2097152 --field-trial-handle=2084,i,12736288640331117602,10499490202572124347,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,3704737558807176679,1607014570228906165,2097152 --field-trial-handle=2084,i,12736288640331117602,10499490202572124347,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,6578864965707307399,441503487363732389,524288 --field-trial-handle=2084,i,12736288640331117602,10499490202572124347,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,3136462116785867084,16400821884089176219,524288 --field-trial-handle=2084,i,12736288640331117602,10499490202572124347,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,68327206728477953,11161927144902480439,524288 --field-trial-handle=2084,i,12736288640331117602,10499490202572124347,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,68327206728477953,11161927144902480439,524288 --field-trial-handle=2084,i,12736288640331117602,10499490202572124347,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,6056684529863579428,5098420881721762747,524288 --field-trial-handle=2084,i,12736288640331117602,10499490202572124347,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,1397846299480233254,9296402214185905097,524288 --field-trial-handle=2084,i,12736288640331117602,10499490202572124347,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,13372622140307496271,18227993225237011808,524288 --field-trial-handle=2084,i,12736288640331117602,10499490202572124347,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,804487796950110004,6434026860429468821,524288 --field-trial-handle=2084,i,12736288640331117602,10499490202572124347,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,14315220260260832037,4919246105208570272,262144 --field-trial-handle=2084,i,12736288640331117602,10499490202572124347,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b82f3ed4d6d857ec07ec9208e2b4720b0252188b092045a9944c3bf4df2dc466
MD5 2fca869d7ed50b536ecd2d93f4589e0f
SHA1 85f04ab3ab5e3656ccd7dc5b241cadb7d23ae9cd
SHA512 612f9306b4e0a8bd9c445d1b4cdf9d1d2dd5c92ac76295b6aeb1fdba6fde5a8ebc06afadaf416b8ce69622e767cb5fd85f0a6e22e0f16dc33863adf3980129cb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1E3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6461ef2e5ca8134a61c9ce283137409dfb15e6e96069a02c2b93ad1e568c7652
MD5 d65e78232419b987dbef8a852d9d53a8
SHA1 d55206ddebf5273811727919cc37cad336a7c57e
SHA512 588084b779ba4cc38241105d17935b1757c3e3d6d1601fd52b2c00b8c424b8b1f3797ad2e3fd4d5208be4f5b0622815d52e0bd83f5f14377cf3e7c91ff8257b4
TLSH
T1B17116340572C3B1E7AA02B19DD72FCD34728CF9F51F6E933890D8B6A6A8F14464514B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe582e2f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582e2f.TMP
Size 3KB
SHA256 4cddd60eaa3379a657d1b12c5a23c6c715f59c92fca94fb7c652ccd2b1a1bb11
MD5 c68bed27b7fe692206378d52661c1502
SHA1 5d232b1c8444763153fbfc84f62b3eaabfac89eb
SHA512 c1c008f517c87f364690209db25d186e62a25c3cd22c0a209c07127145d8ea6ee4222ffa8fffb171514b3a06cd762495e6034ae8f94e679577189ccf22d35f71
TLSH
T17E7128340572C3B0E7AA02B19DD72FCD34724CF9F51F6E933890C8B6A6A8F144645147
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 b958df362096ea710d78138a98d9c03de7372be338dff54ed4ee7afd991d3ece
MD5 2bd0aade9a7ac93e84ed499270c8b7a5
SHA1 bd5a49323c714e7b558af21463a8280c4cc7f1e3
SHA512 a5c5a6af04005659846def2bcf85a590f33516aa623394baf795e9e02375617059598a0f6a789237917dcbf0c4b4cc9eba5ff5932cf662ddeeb881b964c6025b
TLSH
T1FD117DF3C3D585AE890556F05A24EE1BCE1D0505421C7C19C5D4FF2B93E3075D10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a31fe58d010f49700f0210d974f9e3c88cfda8eca54bad9ea110404b404de3f7
MD5 ff656e14cd03b1d91528366a66383fc8
SHA1 55e1a07f2946f370d6a43f0d7efa77425065dc80
SHA512 4f0c94bf4a0aaa18818972ee8f65ae187fd9e0a9230451066fcf68d0aef4908228841519c27544d48cc1418929f45ed3f7a0ef001c2349ee14d1351bf5e72557
SSDEEP 192:sxZjRWyM/jK1Ml8Mk8/fms76FIdpd5HW6+WNGYCk2XM+qIgrJ:sxZjMM8/fms7623HbGzMl9
TLSH
T15342F911BA349977CCCBD209FA55BF53D6F90472A2900E44AAFCDA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9dd9173cd2d3f820079906e95b803c6a2ce3a33eca68eb86d45f6d4ab4470c02
MD5 a24c56a9a637a10377c46fb3a61231b2
SHA1 edab68417f2df64f93d87abb093c5793bb775c3e
SHA512 1d883be6cb9a73f7e7f6dacd9a6f7390d07488b1e8c1765a26619dc778b799818cba14019f2c7f57c5a244aea5ec56abfa245681983c5fbd75a54a1fdcd3aa10
SSDEEP 192:sxZjRWyM/jK1Ml8UQzk8/fmsbYFIdpH5HW6+WNGYCEr/M+qIg54J:sxZjMqY8/fmsbY2ZHbGAMlS
TLSH
T11D52F815AA349977CCDBD20EFA51BF53D6F9047291900E44AAFCDA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a7a31dace503fa244e98cedae12a9458afe515e651013f9d65f7bc7ebd517942
MD5 1e713eb162fe7e932fd52a41a0745b22
SHA1 0ce8bf07ff7931adb3f3eb9682bbb62e621feba2
SHA512 f2ec0d7202ff231c74a75b1419c11960039763e882d2d59fdc74803a0550d9cb98ee9a357eb3bb5e3e798b0004b036f534e105073997d3c9ae76e21b5f3e4f9c
SSDEEP 768:lK8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVSrod:lK8bqn+WvSCt6u1jaCZLbWVJd
TLSH
T1EFD2FA3B280CCB7E4F845E5DEC266F962ED801CB6B988D5447EA884C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1d372b408e4eed42cf7c195227db3cf3c1983b711980db692af0bd169761d413
MD5 1e091ac16505d842011cda9a89c0a1d8
SHA1 6e7da7e40e57d40e82e67dff216a1b967fc05f9c
SHA512 2bedfd7133cbae63995b15e145018400c29f5b1ffa7e198900d9c430d27031c7aa3a8b10bc902be64df0fd3e9d84eb77135b42b8da562d2758218196ee754a58
SSDEEP 48:KwZIFKCwwPyNlIpKuEsGNIFKuoQXyHPALvx5B:KwZ2KCwiWliKuERN6KuoiP
TLSH
T1A091B501703F02412CBE7E1CA195C96ACD4275B23828A8BFB76854D25F6AE612DFDDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

406069d3-f389-4980-b1d3-be6cadf4e289.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\406069d3-f389-4980-b1d3-be6cadf4e289.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9ca62395d9014355d31c6b3228f478ec132d58e38fd0f9efb352a3ca3d595118
MD5 36e6405ae01f8008027ac5e9bc118402
SHA1 49da66b66bf707b26b3a5f5a8cbccbc5a6cd2663
SHA512 a7516e697f9052db9f420b84a80168ea1d828df3fc84da2ae88e5f9fc9f83763240a7865fc12976ffe0dbbfcbe2d0b5b8778af269dcbf729badea056630b3536
SSDEEP 384:yZcIhsNyUmhVmZr4vuEa+wOS7+2vjmInTKwBODNZOC1KDm:AhLmCVa1OS7lvjmInewBKZOud
TLSH
T159928E71AC7C9C379EE7A548F84B36175EF84073E6C96A64D2DDAF1C00E6198130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f658c479d618dadd49e717a5be944d1bcd0e93e9ef45aa8c017992893d29ec73
MD5 871eda9aaf787f9e96765e1adb7f7301
SHA1 1677584010002ca94b5d3b35c966a3d6c1bc0204
SHA512 cf039b0904af918f578613724d75484fa61b055e194a3f5a9379a69819e6febb9dcc635266a40a6f125534718d20435ea4964f999fcf81f44abf57656260e303
SSDEEP 192:vONw6Db6QmiUyaKHBa+jcOmiRqRgjIbU6:vONw6ueHBa+wOBjaU6
TLSH
T1F002E73568786CBB9EA26E48F88B37276FD4103BDA966F44D6D85F0C00D765C230783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 21b53b5cd8ee1355af71a8e4544c3fd42216581bd4f2e25dba11a2f1d4ba11d8
MD5 df4ac7bc5c0b228c8d13247919d2ec8b
SHA1 c63c28d8abd92ae34a20d80506db83cb4e997a0c
SHA512 b0fca52bd7a01254cf76b98097f87fcc3863572bd158c6683e7b402e057098bd94aee4f69bca2c9c207d17e287efd84607856bc34ce763c4b00eb8d9e02e7de9
SSDEEP 384:XiFiZcIrzsNX8TUNTUlIlrhVmZr4vuEa+wOS7+2ajmInTKwBODNZOC1KDm:SFQ/iwg1mCVa1OS7lajmInewBKZOud
TLSH
T108A26D7298688D3B9EE7AA45F84B36179EF84073D5C5AA64E3DDAF1C00E719C130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 fa3591576552b89f6b70744d3fbf34e2c83b755701caf7370eeae55f3ae39989
MD5 ccd5afceac86422c1347945cb004734d
SHA1 659c67ec13abf1b12033b90f359b4551aab4abd9
SHA512 a0cd480ae0c813d8271ca447af3f23486ed3c798bc014e744a408c0f4e71d494c51d25131cd44d96b4440492a6223f75855a4f3b2808803a4d8a11ea98473bac
SSDEEP 384:mZcIhsNyUrhVmZr4vuEa+wOS7+2vjmInTKwBODNZOC1KDm:0h6mCVa1OS7lvjmInewBKZOud
TLSH
T185928E71A83C9C379EE7B549F84B36179EF84073E6C96A64D2DDAF1C00E6598130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0f920019ec33c19dac0feaca1b505eaf14c6d4df1149630a7cd0998816b0d376
MD5 8ce73f09aad3089103accd564db1e47e
SHA1 53aa44f09731e53f3a904ab04910b586a3f39fd5
SHA512 481db7824319abb652f0592340b98ffb30090df28ce49a872f065d87f9da4a6457c4d780ca9564d0367ba67b3b5b0bcf2ee5b663665f79e1f461e6457ad04c09
SSDEEP 192:BONo6DbOQmiUy4KSBa+jcOmiR67+2zNzj2qKRIU6:BONo6iqSBa+wOS7+2tjmIU6
TLSH
T1E4120A36B97C9C775EE36944F48736135EE8502BDA8AAB91D6DC2F0C00EB55C134F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3d29ca3dcd6410c371a7c2c6a7cfbdfaafc672d4d0d6e01782377876939a8b3e
MD5 7789a16c24f9657a41ab27f00c0b65df
SHA1 ed02303c9924d175525669d6d00699975c5f609c
SHA512 5d49eb8a276072aa43abad6142399082c48e264eeac35e5c7f5ad363428050c3ee99b0fb49242f76f93fcca7d3534b74ad8e6e5d664ae33401a935bd4e2e23f3
TLSH
T107412658A6FA1148B3B76F165BF6A8AD447F7D232F4BD49E50010E4F0A22A00C9B2737
MD5 SHA1 SHA512 TLSH

Submit Download